General

What is Fail2ban?

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address. These rules can be defined by the user. Fail2ban can read multiple log files such as sshd or Apache web server ones.

Is Fail2ban free software?

Fail2ban is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

What do you need to run Fail2ban?

What does the version number of Fail2ban mean?

The structure of the version number is major.minor.revision. Currently the major number is 0. The policy for minor is:

odd numbers (0.5, 0.7, etc) are development versions.

even numbers (0.6, 0.8, etc) are stable versions.

New features, code refactoring, configuration or API changes are done mainly in development versions. Stable versions contains security fixes and small improvements that have few chance of breaking something.

Revisions are named alpha, beta, release candidate and stable. Stable versions with even minor versions are always named stable. Development versions are first called alpha, then when stability improves, beta and finally release candidate when the application is close to stabilization.

How to ask for help or submit a bug report or a feature request?

First of all, try to find an answer on this website. Read the FAQ, Manual and visit HOWTOs. Search the mailing lists archives and look at the trackers. If you did not found any answer, subscribe to this mailing list and ask your question there. Registration is required in order to avoid spam.

If you are convinced that you found a bug, you can directly create a new ticket here.

How can I run Fail2ban without installation?

It is possible to run Fail2ban without installation. Fail2ban is written in Python and does not need to be compiled. If you want to quickly test Fail2ban or if you have it already installed and want to test a new version, please follow these steps (for 0.7.x and above):

How can Fail2ban be configured?

Can I exclude failed logins for selected users from resulting in a ban?

(I don't know, perhaps that's a feature request.)

Edit: Cause fail2ban didn't know anything of the username format logged in the specific file(s) (if usernames even get logged), it is only possible to exclude selected users in the regex of the service section.

Security

What do I have to consider when using Fail2ban?

Especially on systems which provide SSH/CGI/PHP services to unknown users, it is possible to block other users from ssh and probably other services. How would a user do so? The user could issue:

Or the malicious user may write via PHP's openlog()/syslog() to syslog.

Solution #1: This security hazard can be handled via ownership/permissions of /dev/log, which allows logging to all the users by default. Just add a group log, add all daemons and root to that group and be happy.

What about log injection?

Fail2ban parses log files of other services and thus it can be vulnerable to log injection. Daniel B. Cid describes this kind of issues in Attacking Log analysis tools. I strongly suggest that you read this article. We will always try to provide safe configuration files. However, you can use fail2ban-regex to test your configuration files against forged log lines.

Troubleshooting

I have Postfix on my system but no "mail" command. How can I get e-mail notifications?

As of version 0.8.1, "mail" actions are deprecated. Please use the "sendmail" ones instead. E.g. sendmail-whois instead of mail-whois in your jail.[conf|local].

You probably have the sendmail command. Copy /etc/fail2ban/action.d/mail-whois.conf to /etc/fail2ban/action.d/mail-whois.local, edit this file and replace mail with sendmail. Here is an example:

I get the error "Please check the format and your locale settings"

This is a known bug. Since 0.6.1, Fail2ban uses your locale settings for date and time format. However, some daemons do not take care of locale and write their log messages using the POSIX standard. Please look at this bug for more details.

You can try to override the LANG variable:

# LANG=en_US /etc/init.d/fail2ban restart

You can get all the available locale with:

# locale -a

How do I increase verbosity?

In order to increase the verbosity of Fail2ban, use the command line option -vvv for fail2ban-client and fail2ban (only for 0.6.x). Set loglevel to 4 in /etc/fail2ban/fail2ban.conf (only for > 0.6.x).

Fail2ban is running but not banning SSH bruteforce

NB:This exemple is based on a Debian system, but can be easily realised on any distro.